Critical infrastructure and investment control – caution in corporate transactions

Critical infrastructure and investment control – caution in corporate transactions

Anyone buying or selling shares in a company that operates critical infrastructure should be careful. This is because an investment control procedure may have to be carried out before the acquisition. Failure to do so may result in fines and imprisonment.

The background is: For decades, the global economy has grown together. However, a trend called decoupling has been emerging for several years. World powers are beginning to close off from each other, such as the U.S. and China. At the latest since the start of the war in Ukraine, there has been growing concern in Germany that important infrastructure will no longer be available.

To protect the population from a failure of this so-called critical infrastructure, the federal government has taken precautions. One of these is that services of general interest should remain within the EU.

For non-EU companies, this means that they cannot easily buy company shares in a critical infrastructure operator. If a buyer based outside the EU (or outside the EFTA area) wishes to acquire at least 10% of the voting rights in such a company, so-called investment control applies to protect public order and security. This means that the purchase of the shares must be reported in advance to the Federal Ministry of Economics and Climate Protection (BMWK). The BMWK examines the planned participation and approves it (if necessary, subject to conditions) or prohibits it.

How many companies fall under critical infrastructure is often underestimated

It is often underestimated how many company acquisitions now fall under the obligation to report to the BMWK. The German Federal Office for Information Security (BSIG) defines critical infrastructure in this way:

Critical infrastructures (CRITIS) are facilities, installations or parts thereof that belong to the sectors of

• Energy
• Information technology and telecommunications
• Transportation and traffic
• Health
• Water
• Nutrition
• Finance and insurance or
• Municipal waste management

and are of great importance to the functioning of the community because their failure or impairment would result in significant supply bottlenecks or threats to public safety.

Above a defined threshold, installations are considered critical

The reporting obligation does not apply to all companies in the sectors mentioned. This is only the case above certain thresholds. The basic rule for all sectors is that the plant must be capable of serving at least half a million people to be considered critical. The Ordinance on the Determination of Critical Infrastructures (BSI-KritisV) specifies when this is assumed in each case for each sector individually. For example, a food manufacturer is currently part of the critical infrastructure if it produces 434,500 tons of food or 350 million liters of beverages. For prescription drugs, the threshold is 4.65 million packages placed on the market per year. A normal generator is considered critical when it produces 104 megawatts of electricity. For certain energy suppliers, the threshold is even lower or non-existent.

Important: These thresholds are always adjusted. It was not until the beginning of 2022 that the thresholds were lowered significantly in some sectors.

Caution also in other industries and in restructurings

Even if at first glance the buyer belongs to an EU member state or the target company does not operate critical infrastructure, close scrutiny is required. This is because a number of other transactions may also be reportable under the German government’s Foreign Trade and Payments Ordinance (AWV). This includes the following constellations:

• In addition to critical infrastructure, there are other industries where investments may be reportable. These are defined in § 55a para. 1 AWV listed. Examples of such industries include aerospace, media, and cybersecurity, as well as certain high technologies, such as robotics, quantum, nuclear, biotechnology, and artificial intelligence. The catalog was again significantly expanded with the AWV amendment in 2021.
• Even intra-group restructurings can fall within the scope of investment control if the (intra-group) new acquiring company is a non-EU company.
• Not only the initial investment, but also the increase of an existing investment may be reportable.
• Cases are also conceivable in which the investment must be registered even though the acquirer is from the European Union. This may be the case if the acquirer itself has shareholders from non-EU member states.

Violations may result in fines and imprisonment

If the reporting requirement is overlooked and a transaction is completed, this can result in significant sanctions. These include, in particular, the invalidity of the underlying contract and its execution, heavy fines and even prison sentences of up to five years.

What should companies do?

It is not always easy for companies to determine whether a transaction needs to be reported. Mistakes, and thus penalties, lurk in many places. Complicating matters further is the fact that the conditions for mandatory reporting may well be changed at short notice and the thresholds for investment control further lowered, as has already happened in the recent past.

Companies from non-EU member states in particular are therefore well advised to have any acquisition of shares checked by a lawyer in advance.

Sufficient time should be allowed for the investment review. As a rule, the procedure at the BMWK takes two months. In individual cases, however, it can take up to eight months.